wigwam/wordpress repository overview

⁠Wordpress Docker base image

!! THIS IS A PROOF-OF-CONCEPT REPO, DO NOT USE IN PRODUCTION !!

Use this as a base image for 'immutable' Wordpress containers. Wordpress installed in this image is configured not to be writable by web server. All necessary file-level changes must be done by extending this image (see example below). This allows better maintenance, versioning, rollbacks and horizontal scaling possibility. Also, it improves Wordpress security by reducing the attack surface.

This image is automatically build and published on Docker Hub: https://hub.docker.com/r/wigwam/wordpress/⁠

⁠How it works

This image is based on debian:stretch base image and has Apache, PHP and all Wordpress dependencies installed from Debian repositories. Wordpress is downloaded and extracted into /var/www/wordpress directory. Apache is configured to use this path as document root. Files in document root are not writable by web server, so "Install/Update plugin/theme" functionality in Wordpress admin panel does not work. In order to install plugins and themes from wordpress.org in build time, a wrapper script wp-install.sh⁠ is provided, see the example below. Entrypoint of this image is docker-entrypoint.sh⁠ a file taken from official Wordpress image and modified to work for immutable containers. It is responsible for applying the configuration specified in environment variables.

⁠Example Dockerfile

You can extend this base image to create a custom Wordpress deployment (see example⁠):

FROM wigwam/wordpress

# Install a theme from wordpress.org catalogue
RUN wp-install.sh theme zenearth

# Install a plugin from wordpress.org catalogue
RUN wp-install.sh plugin simple-lightbox

# Install a custom plugin
COPY cajwan-transcriptor /var/www/wordpress/wp-content/plugins/cajwan-transcriptor
RUN chown -R nobody:nogroup /var/www/wordpress/wp-content/plugins/cajwan-transcriptor

⁠Configuration variables

Containers created from this image can be configured and customized by providing following environment variables (see examples/simple/docker-compose.yml⁠):

Autogenerated Wordpress keys and salts work well with single-container deployments. However, they must be provided externally if the workload is load balanced between multiple containers, as they must be exactly the same for all containers in the deployment. Otherwise, Wordpress will not work properly. If you are constantly being logged out from the admin panel, this is most probably the reason.

⁠Findings

⁠How Wordpress works:

• Wordpress normally rewrites its file structure (upgrades, plugin and theme installations), not advantageous for maintaining and versioning
• Can be prevented by removing web server user's permissions to write files in document root
• Wordpress can be configured not to display buttons to do any file-level actions:

define('DISALLOW_FILE_MODS', true);
define('DISALLOW_FILE_EDIT', true);

• When configured like this, all code-level operations must be done manully - or, in Docker way, by rebuilding the image
• When code self-rewriting is disabled, the only path the web server still needs to have write permissions is wp-content/uploads where Wordpress stores media files
• PHP execution in wp-content/uploads directory can be disabled to prevent possibility of uploading arbitrary PHP script by attacker (only media files should be there)
• Wordpress does not use PHP sessions and is fairly stateless. The shared state is in:
  • MySQL database
  • Media files storage (by default wp-content/uploads directory, plugins can be installed to support different storage backends)

⁠Wordpress official Docker image:

Firstly, I have tried to use official Wordpress Docker image for this project, but it does not work as expected:

• Wordpress official image could not be used, as it uses volume for /var/www/html what cannot be reverted in children images
• wp-cli can't be used for build-time plugins and themes installation as it requires database access which is not yet available

⁠TODO

• SSL support (extra container for letsencrypt)
• Consolidated logging
• Enable plugin/theme specific version installation
• Exlore container limits (memory, ...) options
• Support apache2 prefork mpm config via the environment variables
• Explore nginx/php-fpm options